Using Clair to scan docker images within CI pipelines.
version: ‘1.0’
steps:
Docker-Build:
title: Building docker image
type: build
arguments:
working_directory: ${{main_clone}}
dockerfile: docker/Dockerfile
image_name: '${{CF_REPO_OWNER}}/${{CF_REPO_NAME}}'
tag: master
no_cache: true
build_arguments:
- disable-content-trust=true
ScanImage:
image: codefresh/cfstep-paclair:3.1.0
environment:
- CLAIR_URL=${{CLAIR_IP_ADDRESS}}
- IMAGE=${{BUILD_IMAGE_NAME}}
- REGISTRY_PASSWORD=${{CLAIR_PASSWORD}}
- REGISTRY_USERNAME=${{CLAIR_USERNAME}}
- TAG=${{CF_BRANCH_TAG_NORMALIZED}}
- SEVERITY_THRESHOLD=critical
on_success:
metadata:
set:
- ${{Docker-Build.imageId}}:
- CLAIR_SECURITY: true
- CF_QUALITY: true
- promoted: true
# - coverage : 85%
on_fail:
metadata:
set:
- ${{Docker-Build.imageId}}:
- CLAIR_SECURITY: false
- CF_QUALITY: false